Basically I want to capture the message body of each POST request. This command is as far as I've gotten to it: the "-e text" part because it's not documented anywhere here: https://www.wireshark.org/docs/dfref/ so why does it even work? Anyways, this is the output I get: in bold ** are the parts that I want, without any truncation. Parsing that output through some other program is out of the question because it's impossible to know where to split and where to look for the parts that I want. So how would I do this? Is there another undocumented field that output exactly what I want? asked 25 Jul '15, 09:43  im_a_lawyer edited 25 Jul '15, 09:47 |
2 Answers:
From an academic point of view I think you mean something like: tshark -Y "http.request.method==GET" -Tfields -e http.request.full_uri PLEASE think though, it is pretty much guaranteed to be illegal to obtain this if this is not already your information! Your Nick does not help me in this thought. Whichever field you are interested in (you can look that up in Wireshark in required) should be substituted after -e answered 25 Jul '15, 11:20  DarrenWright showing 5 of 7 show 2 more comments |
This got much easier with Wireshark 2.x or so. At least the following works for me with Wireshark 2.2.5 from Debian 9 but not with Wireshark 1.8.x from RHEL 6: I though would still be interested in a nice solution for Wireshark 1.8. Neither nor are really useful without further manual decoding. answered 29 Mar '17, 06:01  XTaran |
That only gives me the URL for each POST request. I want the actual POST data that goes with it: field=value&field2=value2...
Which field would give me just that? This is completely legal because this is all happening under our own organization and our own people.
tshark -Y "http.request.method==POST" -Tfields -e data.data?
Why GET? Also No, that didn't work. I just get blank lines:
http://i.imgur.com/fwn0hu3.png?1
yeah, sorry ^^ POST should be there copy paste is bad.. I am having trouble finding a site I can POST to that isn't https.. You have blank lines with GET because there is not data.data
strange, when I do this (with POST) it delivers me the information. It is HEX, but you can convert that easily enough
Then what does the "text" field do? Why isn't that documented? It appears to work somewhat, but if I do:
"http.request.method == POST && data.data", then not every POST request with data gets captured. Some go missing. What am I doing wrong? Is everyone 100% positive that data.data is what I should be using?
I'm not even 10% positive that is what you should be using..
You are referencing a wireshark page whilst asking a tshark question, a small but important difference.
https://www.wireshark.org/docs/man-pages/tshark.html
scroll down to -e and -T for explanations of the fields. You may also want to look the at -E parameter.
-Y "http.request.method == POST" is fine for filter, you don't need to && anything to it. As for data.data: in my attempts, all the login info was contained there, mileage may vary. The easiest way is to open / start a capture in Wireshark, look at the field containing the Information you are interested in and use this as a -e PARAMETER next time.
That field always has a different name. If I'm submitting a regular form, then that whole field is named: HTML Form URL Encoded: application/x-www-form-urlencoded If it's a multipart form then it is named: "MIME Multipart Media Encapsulation, Type: multipart/form-data
If raw data is sent then somehow it is still called multipart/form-data...
basically, data.data does not capture all POST requests, but since I'm probably only interested in form-data, then I'll just settle for:
-e urlencoded-form.key -e urlencoded-form.value
I'll accept your answer anyways